Executive brief
OpenEXR is a widely-used image format library used extensively in film and animation production. A flaw in 32-bit builds allows a specially crafted EXR image file to cause a heap buffer overflow when the file is opened, potentially leading to application crashes or arbitrary code execution. Attackers can exploit this by distributing malicious image files to users, compromising systems that process digital media assets.
Technical details
An integer overflow vulnerability exists in the Array2D tile-conversion buffer size calculation on ILP32 (32-bit) and LLP64 (Windows MSVC) architectures. When processing a crafted tiled EXR file with a small data window (40x40) but extremely large tile dimensions (65537x65537), the multiplication of sizeX * sizeY overflows in 32-bit long arithmetic, causing the heap allocation to be vastly undersized. During subsequent tile decoding via the TiledRgbaInputFile API, writes to this undersized buffer overflow into adjacent heap memory. The vulnerability requires only the ability to provide a malicious EXR file to a vulnerable application; no authentication or special privileges are required. Patches are available in OpenEXR 3.2.11, 3.3.13, and 3.4.14, which fix the overflow by casting operands to size_t before multiplication.
Affected products
- Academy Software Foundation OpenEXR before 3.2.11, 3.3.0 through 3.3.12, 3.4.0 through 3.4.13
Timeline
- 2026-08-25: disclosed